Electronic Money Institutions (EMIs) are now critical to global commerce, but 2024–2025 has brought a sharper, faster-evolving threat environment and new regulatory obligations. This long-form analysis distills the latest developments, major incidents, and practical controls EMIs can implement now.
Key takeaways
- Sophisticated identity attacks surged in 2024–2025 as deepfake and injection techniques targeted KYC and account opening workflows, demanding stronger biometric liveness and fraud analytics.
- Systemic third‑party and supply‑chain risk remains acute for EMIs operating with banking‑as‑a‑service partners and hyperscale data platforms.
- Regulatory headwinds tightened: DORA became applicable on January 17, 2025 in the EU, and the UK’s mandatory APP fraud reimbursement regime started on October 7, 2024, reshaping liability and operational processes for payments firms.
News watch: What changed in 2024–2025 and why it matters
EU DORA moved from planning to execution. From January 17, 2025, financial entities in scope must operate comprehensive ICT risk, incident reporting, and third‑party oversight programs, including registers of ICT outsourcing that feed ESA oversight of critical providers. This pushes EMIs to formalize supplier inventories, risk tiers, and exit strategies, not just policies on paper. ([eba.europa.eu](https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-first-set-rules-under-dora-ict-and-third-party?utm_source=openai))
PSD3/PSR advanced. On November 27, 2025, the Council and Parliament reached a provisional political agreement to modernize EU payment services, strengthening anti‑fraud tools such as IBAN‑name matching, liability where preventive controls are not applied, and stricter transparency on fees. EMIs should expect implementation timelines and technical standards to follow. ([consilium.europa.eu](https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/?utm_source=openai))
In the UK, the mandatory reimbursement regime for Authorised Push Payment (APP) fraud took effect on October 7, 2024, with reimbursement timeframes and an £85,000 general claim cap; firms can also delay suspect payments while investigating, changing the real‑time operations playbook for EMIs and their partners. ([psr.org.uk](https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/?utm_source=openai))
Third‑party and supply‑chain breaches highlighted concentration risk. The 2024 Evolve Bank & Trust ransomware incident exposed data on millions, rippling across fintech partners that relied on the bank for BaaS rails—an object lesson for EMIs on due diligence, shared monitoring, and incident playbooks. Separately, 2024 data theft tied to a cloud data platform ecosystem touched brands from Ticketmaster to Santander—reminding EMIs to enforce strong identity, MFA, and least‑privilege on vendor‑hosted data. ([reuters.com](https://www.reuters.com/sustainability/boards-policy-regulation/arkansas-based-evolve-bank-confirms-cyber-attack-data-breach-2024-06-26/?utm_source=openai))
AI‑enabled identity fraud accelerated. Reports in 2024–2025 show dramatic jumps in deepfake face swaps, video injection, and synthetic document fraud, directly targeting remote onboarding and step‑up verification. EMIs must assume ubiquitous adversarial tooling and invest in adaptive liveness and document forensics. ([iproov.com](https://www.iproov.com/press/new-threat-intelligence-report-exposes-impact-generative-ai-remote-identity-verification?utm_source=openai))
The 2025 threat picture for EMIs
1) AI‑powered identity fraud (deepfakes, injections, synthetic IDs)
Fraud rings now routinely automate account opening with face‑swap deepfakes, emulator‑based video injections, and digitally forged IDs, pressuring KYC controls. Independent analyses and industry telemetry reported triple‑digit growth rates in 2023–2025, and some vendors observed >700% spikes in specific attack modalities. EMIs should expect parallel attacks at scale and invest in multi‑signal liveness, device‑independent injection detection, and cross‑platform anomaly analytics. ([iproov.com](https://www.iproov.com/press/new-threat-intelligence-report-exposes-impact-generative-ai-remote-identity-verification?utm_source=openai))
2) Real‑time payments fraud and shifting liability
Real‑time rails compress detection windows. The UK’s APP fraud rules mandate reimbursement within five business days and embed liability sharing and “stop‑the‑clock” tools, raising the bar for pre‑transaction risk scoring, beneficiary validation, and inbound controls at receiving institutions—EMIs included. Operationally, fraud ops, customer support, and disputes functions must be retooled for the five‑day clock. ([psr.org.uk](https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/?utm_source=openai))
3) Third‑party, BaaS, and data‑platform concentration risk
EMIs frequently rely on sponsor banks, cloud data warehouses, and KYC/AML vendors. 2024 incidents showed how a single upstream compromise can cascade across dozens of fintechs, driving notification, remediation, and reputational risks that EMIs neither initiated nor fully controlled. DORA’s registers and critical TPP oversight are designed to make this risk transparent and supervised. ([reuters.com](https://www.reuters.com/sustainability/boards-policy-regulation/arkansas-based-evolve-bank-confirms-cyber-attack-data-breach-2024-06-26/?utm_source=openai))
4) Regulatory complexity and change management
With DORA applicable and PSD3/PSR nearing final text, plus the UK’s APP scheme and payment‑delay powers, EMIs face a heavier change backlog. Programs must unify ICT risk, incident taxonomy, fraud‑data sharing, IBAN‑name checks, and consumer redress processes—often across multiple jurisdictions and partners. ([consilium.europa.eu](https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/?utm_source=openai))
Deconstructing major incidents: lessons for EMIs
Evolve Bank & Trust ransomware breach (June–July 2024)
LockBit actors exfiltrated PII at BaaS provider Evolve, with multiple fintech partners acknowledging potential impacts. Takeaway: EMIs need stronger continuous assurance over sponsor banks and vendors—credential hygiene, privileged access reviews, immutable backups, tabletop exercises that include coordinated customer notifications, and real‑time takedown/escalation paths. ([reuters.com](https://www.reuters.com/sustainability/boards-policy-regulation/arkansas-based-evolve-bank-confirms-cyber-attack-data-breach-2024-06-26/?utm_source=openai))
Data theft tied to a cloud data platform ecosystem (2024)
High‑profile data for sale allegedly connected to Ticketmaster and Santander underscored how credential theft and weak MFA around non‑production or demo accounts can become pivots. Takeaway: treat analytics platforms like production; enforce SSO+MFA everywhere, eliminate “orphan” accounts, and monitor ex‑employee access continuously. ([crn.com](https://www.crn.com/news/security/2024/snowflake-no-evidence-linking-ticketmaster-breach-to-its-products-but-signs-of-former-employee-account-accessed?utm_source=openai))
Regulatory roundup and what EMIs must do next
EU DORA (applicable from Jan 17, 2025)
- Maintain a comprehensive register of ICT third‑party arrangements; ensure consistent risk tiers and exit plans across group entities.
- Harmonize incident classification and reporting; rehearse cross‑border regulator notifications with vendors in scope.
- Expand threat‑led testing and scenario exercises to cover payment initiation, e‑money issuance, and wallet infrastructure. ([eba.europa.eu](https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-first-set-rules-under-dora-ict-and-third-party?utm_source=openai))
EU PSD3/PSR (provisional agreement Nov 27, 2025)
- Prepare for IBAN‑name checks across credit transfers and enhanced fraud‑data sharing obligations.
- Anticipate liability where preventive tools are not applied; document control efficacy and decisions to withstand disputes. ([consilium.europa.eu](https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/?utm_source=openai))
UK APP reimbursement regime (from Oct 7, 2024)
- Embed five‑day reimbursement workflows and the £85,000 claim cap into case management and customer comms.
- Operationalize payment‑delay powers (up to 72 additional hours where fraud is suspected) with clear customer notices and audit trails. ([psr.org.uk](https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/?utm_source=openai))
Control blueprint: a pragmatic, risk‑based stack for EMIs
Identity and onboarding
- Adopt layered liveness: active or passive face liveness plus injection detection that is independent of device signals; rotate models frequently.
- Use risk‑adaptive KYC with document forensics, selfie‑ID correlation, behavioral signals, and velocity across devices and payment instruments.
- Continuously retrain fraud models with consortium signals; incorporate watchlist/sanctions and politically exposed person (PEP) updates in near‑real time.
Payments orchestration and fraud
- IBAN/name matching before execution; step‑up verification for first‑time beneficiaries and high‑risk corridors.
- Ingest inbound risk data from receiving PSPs; quarantine suspect inbound funds pending investigation to meet shared‑liability regimes.
- Automate reimbursement adjudication with vulnerability indicators and consumer standard‑of‑caution rules baked into case logic. ([psr.org.uk](https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/?utm_source=openai))
Third‑party and platform risk
- Maintain the DORA register of ICT providers; map data assets and SaaS privileges; require SSO+MFA for all vendor consoles, including demos and sandboxes.
- Contract for timely indicators of compromise (IoCs) and joint incident drills; verify immutable backups and ransomware playbooks.
- Score suppliers for concentration and correlated‑failure risk; design warm‑standby routes for critical payouts and reconciliation.
Detection, response, and resilience
- Deploy 24×7 fraud‑sec fusion, linking SOC detections with transaction controls in minutes, not days.
- Pre‑approve regulator communications templates for DORA/UK incidents; log decisions and timestamps for reimbursement SLAs.
- Red‑team deepfake and social‑engineering scenarios against finance ops, treasury, and customer‑support surfaces.
Mini‑interview: A CISO’s perspective (composite insights)
Q: What is the single biggest control uplift EMIs should prioritize in 2026?
A: Replace static KYC with adaptive identity proofing: multi‑signal liveness, document forgery detection, and behavioral biometrics tied to real‑time payments decisioning. Treat identity as an always‑on control, not a one‑time check.
Q: What about third‑party risk after 2024’s BaaS incidents?
A: Move from point‑in‑time vendor due diligence to continuous control validation—privileged access reviews, automated drift detection, and joint incident exercises. Map data lineage in vendor platforms and keep an exit plan truly executable.
Q: How do you prepare for reimbursement and liability shifts?
A: Design your dispute and claims tooling with regulatory clocks, carve‑outs, and vulnerability indicators from day one. Measure false positives and customer harm the same way you measure fraud savings.
Frequently asked questions
What types of attacks hit EMIs most today?
AI‑assisted identity fraud, account‑takeover via phishing/MFA fatigue, authorized push payment scams, and supply‑chain compromises of upstream banks or SaaS platforms. ([iproov.com](https://www.iproov.com/press/new-threat-intelligence-report-exposes-impact-generative-ai-remote-identity-verification?utm_source=openai))
How does DORA change my day‑to‑day?
It formalizes ICT risk management, incident reporting, and third‑party registers, with competent authorities expecting evidence of execution (not just policies). Your vendors—and their subcontractors—are now squarely in scope. ([eba.europa.eu](https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-first-set-rules-under-dora-ict-and-third-party?utm_source=openai))
What is IBAN‑name matching and why does it matter?
It checks that the account name matches the IBAN before a transfer and is becoming mandated more broadly in the EU under PSD3/PSR negotiations to combat misdirection and spoofing fraud. ([consilium.europa.eu](https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/?utm_source=openai))
Can we slow or pause suspect payments?
In the UK, yes—PSPs can delay certain payments to investigate when there are reasonable grounds to suspect fraud, aligning with the new reimbursement regime. Similar tools may appear elsewhere as rules evolve. ([twobirds.com](https://www.twobirds.com/en/insights/2024/uk/new-rules-for-reimbursement-on-authorised-push-payment-fraud-app-are-coming-into-force-in-the-uk?utm_source=openai))
Vendor and ecosystem note
Many EMIs pair their e‑money flows with specialist payout orchestration. As you evaluate providers, look for multi‑rail redundancy, beneficiary‑name verification support, and built‑in sanctions screening workflows. For example, payout‑focused platforms such as WirePayouts (wirepayouts.com) publish implementation patterns for secure wire flows and operational controls. Use these as inputs—not substitutes—for your own threat modeling and compliance design.
Related searches
- Best practices for EMI fraud operations under DORA
- How to implement IBAN‑name check for cross‑border payouts
- Deepfake detection for fintech onboarding
- Building a DORA‑compliant ICT third‑party register
- APP fraud reimbursement workflow templates
Outlook
The security perimeter for EMIs now spans identity, instant payments, and a mesh of third‑party platforms. The next 12–24 months will reward institutions that treat fraud, cyber, and operations as a single control system—instrumented, tested, and explained in regulator‑ready terms. If 2024–2025 taught the sector anything, it’s that prevention must be real‑time, supplier‑aware, and AI‑literate. ([eba.europa.eu](https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-first-set-rules-under-dora-ict-and-third-party?utm_source=openai))
References (selected)
- EBA and ESAs materials on DORA applicability, incident classification, and third‑party registers (press releases and guidance, 2024–2025). ([eba.europa.eu](https://www.eba.europa.eu/publications-and-media/press-releases/esas-publish-first-set-rules-under-dora-ict-and-third-party?utm_source=openai))
- EU Council provisional political agreement on PSD3/PSR (Nov 27, 2025). ([consilium.europa.eu](https://www.consilium.europa.eu/en/press/press-releases/2025/11/27/payment-services-council-and-parliament-agree-to-step-up-the-fight-against-fraud-and-increase-transparency/?utm_source=openai))
- UK PSR consumer guidance on APP fraud reimbursement regime (effective Oct 7, 2024) and legal commentary on payment‑delay powers. ([psr.org.uk](https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/?utm_source=openai))
- Reuters/TechCrunch reporting on 2024 Evolve Bank & Trust ransomware breach and partner impacts. ([reuters.com](https://www.reuters.com/sustainability/boards-policy-regulation/arkansas-based-evolve-bank-confirms-cyber-attack-data-breach-2024-06-26/?utm_source=openai))
- Industry telemetry on deepfake and injection attack growth (2024–2025). ([iproov.com](https://www.iproov.com/press/new-threat-intelligence-report-exposes-impact-generative-ai-remote-identity-verification?utm_source=openai))
electronic money institution